4 ms·

>But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit

>But most of 2024's network security problems originate from the devices behind your firewall getting exploited through their on requests, not some random shit connecting from the outside. That is Survivor Bias at its best. The originate _inside_ because NAT effectively blocks all _external_ requests.

eqvinox 2y ago
> The originate _inside_ because NAT effectively blocks all _external_ requests. You mean the firewall effectively blocks all external requests.
- noduerme 2y ago
  Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.
  - tjoff 2y ago
    That is because most systems comes with a firewall on and fairly limited surface area in the form of exposed services. But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world.
    - throw0101d 2y ago
      > But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world. Yes. And you can not-expose them via default deny firewall rule. My home printer had an IPv6 in a prefix assigned from my ISP, but it was not accessible to the Internet (it was actually ping6-able because my Asus allowed ICMPv6 by default, but I could not connect to its web interface, like I can internally). Neither could I SSH into my macOS desktop or laptop from the outside (but could between the two internally). And even if my globally addressable devices were globally reachable (which they were not), good luck scanning a /64.
      - tjoff 2y ago
        I know. But this old NAT vs. firewall crap was pointless decades ago. Still is.
- Sophira 2y ago
  You are technically correct that iptables is what provides the NAT functionality on Linux (by way of the MASQUERADE target), which many routers run. However, you are very incorrect that the firewall is directly involved in blocking the request. The reason NAT works for this is because by default there are no Internet-accessible services available via the router. If a request is received by the router that doesn't match an open port, its OS will, by default, reject it, with no firewall required.
  - superb_dev 2y ago
    So then what’s this default firewall rule I have that blocks all non-established connections? NAT is not required for any of the things you’re talking about.
    - pas 2y ago
      okay now I'm curious what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? without having a corresponding conntrack entry they will be dropped (and maybe even an ICMP message sent back, depending on the protocol), no? for example if there is an incoming TCP packet with a 4-tuple (src ip, src port, dst ip, dst port) ... by necessity "dst ip" is the public IP of the NAT box, and on a pure NAT box there are no bound listening sockets. so whatever "dst port" is .. unless it gets picked up by an established NAT flow ... it will splash on the wall and getting a TCP RST. isn't the argument that "NAT is not required", but that "NAT is implicitly a firewall"?
      - eqvinox 2y ago
        On a directly connected outside system, you can set a route for your LAN address space via that router and it will just work. It requires telco or physical access but I have in fact done this before.
      - throw0101d 2y ago
        > what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? See perhaps stateless NAT: * https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Stateless_NAT https://wiki.nftables.org/wiki-nftables/index.php/Performing...

eqvinox 2y ago

> The originate _inside_ because NAT effectively blocks all _external_ requests. You mean the firewall effectively blocks all external requests.

noduerme 2y ago
Regardless, it's a fair point. Most of the attack surface on client / end user boxes these days is through social engineering and end user stupidity. Vanishingly little of it on modern OSes comes from external sources like a scan revealing a mistakenly open port. It's just that the threat profile has shifted toward making users make mistakes to the point where so much resource is thrown at fooling users now that, by the numbers and the ransomware profits, it's more effective than trying to penetrate software remotely.
- tjoff 2y ago
  That is because most systems comes with a firewall on and fairly limited surface area in the form of exposed services. But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world.
  - throw0101d 2y ago
    > But, there are billions of other devices (IoT etc). that barely has any security protections in place that rely completely on not being exposed to the outside world. Yes. And you can not-expose them via default deny firewall rule. My home printer had an IPv6 in a prefix assigned from my ISP, but it was not accessible to the Internet (it was actually ping6-able because my Asus allowed ICMPv6 by default, but I could not connect to its web interface, like I can internally). Neither could I SSH into my macOS desktop or laptop from the outside (but could between the two internally). And even if my globally addressable devices were globally reachable (which they were not), good luck scanning a /64.
    - tjoff 2y ago
      I know. But this old NAT vs. firewall crap was pointless decades ago. Still is.
Sophira 2y ago
You are technically correct that iptables is what provides the NAT functionality on Linux (by way of the MASQUERADE target), which many routers run. However, you are very incorrect that the firewall is directly involved in blocking the request. The reason NAT works for this is because by default there are no Internet-accessible services available via the router. If a request is received by the router that doesn't match an open port, its OS will, by default, reject it, with no firewall required.
- superb_dev 2y ago
  So then what’s this default firewall rule I have that blocks all non-established connections? NAT is not required for any of the things you’re talking about.
  - pas 2y ago
    okay now I'm curious what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? without having a corresponding conntrack entry they will be dropped (and maybe even an ICMP message sent back, depending on the protocol), no? for example if there is an incoming TCP packet with a 4-tuple (src ip, src port, dst ip, dst port) ... by necessity "dst ip" is the public IP of the NAT box, and on a pure NAT box there are no bound listening sockets. so whatever "dst port" is .. unless it gets picked up by an established NAT flow ... it will splash on the wall and getting a TCP RST. isn't the argument that "NAT is not required", but that "NAT is implicitly a firewall"?
    - eqvinox 2y ago
      On a directly connected outside system, you can set a route for your LAN address space via that router and it will just work. It requires telco or physical access but I have in fact done this before.
    - throw0101d 2y ago
      > what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox? See perhaps stateless NAT: * https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Stateless_NAT https://wiki.nftables.org/wiki-nftables/index.php/Performing...